Ohio MHAS Exposes PHI of 59K Patients by Mailing Surveys on Postcards
This week, patients of the Ohio Department of Mental Health and Addiction Services (OMHAS) were notified of a privacy incident that occurred on February 3, 2016.
Patients were sent a satisfaction survey by mail; however, the survey request was sent on postcards rather than in sealed envelopes. Consequently, the fact that each patient had received services related to mental health and addition was inadvertently exposed along with patients’ names and addresses.
This was not the first time that these mailings were sent to patients. Each year, OMHAS sends customer satisfaction surveys to patients to obtain feedback about the services they received. The aim of the mailings is to obtain data from patients that can be used to improve the services OMHAS provides and as part of the reporting requirements required for the federal Mental Health Block Grant.
On February 25, 2016, OMHAS became aware that the mailing breached Health Insurance Portability and Accountability Act Rules. An investigation into the privacy breach revealed that similar mailings had been sent in the past. In total, 59,000 patients were affected by the privacy incident.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
While no highly sensitive data such as financial information, Insurance details, medical data, or Social Security numbers were exposed as a result of any of the mailings, it is conceivable that patients could come to harm or suffer discrimination by disclosing that they were patients of OMHAS.
OMHAS is now in the process of notifying all affected patients of the privacy breach by mail. The incident has prompted OMHAS to conduct a review of internal policies and procedures relating to customer outreach. In future, all mailings of this nature will be sent in sealed envelopes rather than using postcards to ensure that the privacy of patients is protected. Additional training on privacy will also be provided to all department staff members.
